CVE-2026-53872CWE-22

picklescan - Arbitrary File Read via Unsafe Pickle Deserialization

High · published June 17, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
52.1
In the wild
Unconfirmed
What it is

picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen. Attackers can bypass RCE-focused blocklists to exfiltrate sensitive data like /etc/passwd to external servers.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00686 · 52.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-06-17T15:05Z
EPSS history
Timeline
  • 17 JUN 15:05Z
    picklescan - Arbitrary File Read via Unsafe Pickle Deserialization
    cvelistv5